CVE Vulnerability Catalog

In the Linux kernel, a use-after-free vulnerability was found in the NVMe over Fabrics (nvmet) subsystem for PCIe Endpoint controllers (pci-epf). The function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir after calling req->execute(), but for commands without device-to-host data transfer, the iod can be freed asynchronously on another CPU before those fields are read, leading to a use-after-free.

In the Linux kernel's fbdev subsystem, a lack of consistency in handling display mode changes was found. Some call paths (e.g., via sysfs) did not update fbcon state, potentially leading to incorrect console behavior. A helper function fb_set_var_from_user() was introduced to centralize mode change handling, including fbcon updates.

In the Linux kernel's fbdev subsystem, a lack of synchronization when accessing the modelist and current mode in sysfs operations was found. Concurrent read/write could lead to use-after-free or storing a freed pointer. The fix adds lock_fb_info() locking in show_mode(), show_modes(), and store_mode().

A vulnerability in the Linux kernel's MPTCP subsystem causes a memory leak due to a race between socket teardown and concurrent userspace PM ANNOUNCE handling. The issue stems from improper synchronization in mptcp_pm_destroy() and allocation paths, leading to lost list entries and memory leaks.

In the Linux kernel's HID magicmouse driver, a vulnerability allows unbounded recursion in magicmouse_raw_event(). A malicious HID device can send a report with the sequence [0xf7, 0x00], causing thousands of nested calls and kernel stack overflow. The fix bounds recursion depth to two levels.

In the Linux kernel's HID magicmouse driver, a use-after-free vulnerability was found. If input device registration fails, the msc->input pointer remains non-NULL, leading to dereferencing freed memory on subsequent reports. The fix clears the pointer when no input device is claimed.

In the Linux kernel HID subsystem, a vulnerability was found involving an out-of-bounds read in hid_set_field(). The issue arises because hid_dump_input() is called before the offset bounds check, which with CONFIG_DEBUG_FS enabled can lead to reading beyond the allocated usage[] array. The bug was reported by XBOW and affects e.g. the picolcd driver.

In the Linux kernel, the HID PIDFF driver (hid_pidff) has a vulnerability involving an out-of-bounds write when the hid->inputs list is empty. The function hid_pidff_init_with_quirks() derives a pointer to hid_input without checking if the list is empty, leading to a type-confused pointer and writes past the end of the object. An attacker can trigger the vulnerability by plugging in a malicious USB device, with no user interaction or logged-in user required.

In the Linux kernel, the net/ionic driver has a vulnerability involving an out-of-bounds read when looking up the TX partner for the dedicated hardware timestamp RX queue. This queue has an index equal to the number of regular queue pairs, causing a read past the txqcqs array and a write through the derived pointer. The fix avoids pairing this queue and makes the XDP_TX path abort cleanly if no TX partner exists.

In the Linux kernel's futex/pi mechanism, there is a vulnerability where a private futex owner from a different address space is accepted. The private futex key borrows the waiter's mm without taking an mm_users reference, and attach_to_pi_owner() copies the key into the owner's PI state. When the owner exits, a use-after-free can occur if the waiter's mm is freed concurrently. The fix adds validation that for private futexes, the owner's mm and waiter's mm are the same.

In the Linux kernel's futex/pi mechanism, there is a race condition during exec() for private futexes. There is a window between setting exit_state to OK and changing the mm pointer where the mm check is incorrect, potentially leading to use-after-free. The fix sets exit_state to FUTEX_STATE_DEAD in futex_exec_release() and only sets it to FUTEX_STATE_OK after the mm switch.

A race condition in futex_pivot_pending() during private hash resize in the Linux kernel can leave a task blocked in uninterruptible sleep indefinitely, leading to a hung-task detection and kernel panic.

A race condition was found in the Linux kernel during the initial allocation of mm->futex.phash.ref. In certain nested vfork scenarios, two processes sharing the same address space can concurrently allocate and overwrite this counter, leading to a use-after-free in futex_q_lock().

In the Linux kernel's HID driver for ASUS devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Huawei devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Nintendo devices, there is an out-of-bounds read vulnerability in joycon_ctlr_read_handler(). The function casts an incoming HID report to struct joycon_input_report, guarding only with a 12-byte length check, while the structure is 49 bytes. For an IMU report of exactly 12 bytes, it can read past the declared length, and the data is forwarded to userspace, leaking driver-internal memory. The fix applies the full structure size check.

In the Linux kernel's HID driver for Nintendo devices, there is a vulnerability where the input device is registered before all capabilities are set. input_register_device() exposes the device to userspace immediately, and calling it before configuring FF_RUMBLE can lead to NULL dereference on concurrent EVIOCSFF. The fix moves registration to the end of joycon_input_create(), after all capabilities are configured.

In the Linux kernel's HID driver for Nintendo devices, there is a use-after-free vulnerability during failed probe. nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop(), allowing HID reports to still be processed and access driver data being torn down. The fix adds an err_io_stop label that calls hid_device_io_stop() before hid_hw_close().

In the Linux kernel, the HID rapoo driver lacked a hid_is_usb() check before using to_usb_interface(). uhid devices can be identified as USB but not have a USB parent, leading to a kernel crash.

In the Linux kernel, the HID ft260 driver has a stack-use-after-return write during I2C read operations. A race between the read path and ft260_raw_event() can lead to a write to freed stack memory.